MadrasThemes MAS Videos plugin contains an improper validation of filenames used in include/require statements, leading to a Local File Inclusion (LFI) vulnerability. This flaw permits an attacker to specify arbitrary file paths when the plugin attempts to include a file, potentially allowing the reading of sensitive files on the server. If the targeted file contains PHP code, inclusion could also lead to execution of that code, although the description does not confirm that this outcome is guaranteed.

All releases of the MAS Videos plugin from its initial version through version 1.3.4 are affected. Any WordPress site using MAS Videos 1.3.4 or earlier is at risk, independent of other plugins or themes.

The CVSS score of 7.5 indicates high severity for this LFI. EPSS of less than 1 % suggests that exploitation events are currently rare. The flaw is not listed in CISA KEV. The most likely attack vector is inferred: an attacker would send a crafted HTTP request to the plugin’s endpoint that includes a manipulated filename parameter, allowing directory traversal or arbitrary path specification. If the server environment permits execution of the included PHP file, remote code execution could follow. These details are inferred from the nature of the flaw, as the description does not provide a specific request structure.